Duplicate Post
Monthly
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.